Archive
028
EXH-0282024Fictional reconstruction

The Exposed Env File

A small startup pushed a build with the wrong directory listed as public. You arrive after the bots have already noticed.

Type
Modern / Cloud
Difficulty
Beginner
Era
2020s
Time
8 min

Briefing

At 03:14 UTC the deploy bot shipped commit 8f1c2a as production. Nothing alerted. By 03:22 the cache hit rate on /.env was already non-zero. You inherited the laptop, not the deployment. Start by looking around.

Your role

On-call engineer for the fictional startup Fakecorp. The CTO paged you eleven minutes ago.

Objective

Find what was exposed, confirm it was scraped, and explain how to prevent it next time.

Terminal environment

user
operator
host
edge-01
cwd
/srv/fakecorp
steps
5
Enter the terminalAbout 8 minutesSafe simulation

Safety note. This is a safe reconstruction. All systems, files, hosts, credentials, and outputs are simulated. Do not use these techniques on systems you do not own or have explicit permission to test.